Nmap Cheat Sheet

Return to TOC

Basic Scanning

Command Description Example
nmap [target] Basic scan of the target nmap 192.168.1.1
nmap -v [target] Verbose scan of the target nmap -v 192.168.1.1
nmap -A [target] Advanced scan with OS and version detection nmap -A 192.168.1.1
nmap -T4 [target] Faster scan with timing template nmap -T4 192.168.1.1

Host Discovery

Command Description Example
nmap -sP [network] Ping scan to discover live hosts nmap -sP 192.168.1.0/24
nmap -sn [network] Ping scan without port scan nmap -sn 192.168.1.0/24
nmap -Pn [target] Scan without ping nmap -Pn 192.168.1.1
nmap -PS [target] TCP SYN discovery on specified ports nmap -PS 192.168.1.1
nmap -PU [target] UDP discovery on specified ports nmap -PU 192.168.1.1

Port Scanning

Command Description Example
nmap -p [port] [target] Scan specific port nmap -p 80 192.168.1.1
nmap -p [port-range] [target] Scan range of ports nmap -p 20-80 192.168.1.1
nmap -F [target] Fast scan of top 100 ports nmap -F 192.168.1.1
nmap -r [target] Scan ports consecutively nmap -r 192.168.1.1
nmap --top-ports [number] [target] Scan top [number] ports nmap --top-ports 10 192.168.1.1

Service and OS Detection

Command Description Example
nmap -sV [target] Version detection nmap -sV 192.168.1.1
nmap -O [target] OS detection nmap -O 192.168.1.1
nmap -A [target] Advanced scan with OS and version detection nmap -A 192.168.1.1
nmap --script [script] [target] Run specific Nmap script nmap --script http-title 192.168.1.1
nmap -sC [target] Run default scripts nmap -sC 192.168.1.1

Output Options

Command Description Example
nmap -oN [file] [target] Normal output to file nmap -oN output.txt 192.168.1.1
nmap -oX [file] [target] XML output to file nmap -oX output.xml 192.168.1.1
nmap -oG [file] [target] Grepable output to file nmap -oG output.gnmap 192.168.1.1
nmap -oA [basename] [target] Output in all formats nmap -oA output 192.168.1.1

Miscellaneous

Command Description Example
nmap -v [target] Increase verbosity nmap -v 192.168.1.1
nmap -d [target] Increase debugging level nmap -d 192.168.1.1
nmap --open [target] Show only open ports nmap --open 192.168.1.1
nmap --reason [target] Show reason for each port state nmap --reason 192.168.1.1
nmap --packet-trace [target] Show all packets sent and received nmap --packet-trace 192.168.1.1
nmap --iflist Show host interfaces and routes nmap --iflist